pg_surgery: Fix off-by-one bug with heap offset
Michael Paquier <michael@paquier.xyz>
pg_surgery: Fix off-by-one bug with heap offset heap_force_common() declared a boolean array indexed with an OffsetNumber for a size of MaxHeapTuplesPerPage. OffsetNumbers are 1-based, so an input TID whose offset number equals MaxHeapTuplesPerPage wrote one byte past the end of the stack array, crashing the server. Like heapam_handler.c, this commit changes the array so as it uses a 0-based index, substracting one from the OffsetNumbers. Reported-by: Wang Yuelin <violin0613@tju.edu.cn> Reviewed-by: Ashutosh Sharma <ashu.coek88@gmail.com> Discussion: https://postgr.es/m/20260604002256.40f1fd544@smtp.qiye.163.com Backpatch-through: 14
Files
| Path | Change | +/− |
|---|---|---|
| contrib/pg_surgery/heap_surgery.c | modified | +3 −3 |
Discussion
- Fw: Re: heap_force_common in contrib/pg_surgery/heap_surgery.c has an off by one stack buffer overflow 10 messages · 2026-06-03 → 2026-06-06